Selective fields per output

[Akumar (Ash Kumar)]

I would like to drop certain fields from elasticsearch indexing but retain them for output to another destination.

I have two use cases

1. Some fields contain detail that I only want for an investigation and do not want to index
2. Metrics fields that I want to send to a graphite aggregator and not to an Index.

Is there a way to select "if output == elasticsearch then drop fields f1, f2, f3 ?

Thanks

Ash Kumar

[ebuildy (Thomas Decaux)]

It seems not possible right now ;-(

There are some workarounds, such as:

• Use clone filter (https://www.elastic.co/guide/en/logstash/current/plugins-filters-clone.html) and mutate filter
• Use 3 logstash instances !
  • 1 ==> output in queue
  • 2 ==> input from queue ==> output to ES
• Write your own plugin, it's dramatically easy, and the best way to fit your needs